← Back
CWE-79

48,706 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

JSON object

Loading...

CVEs (48,706)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2019-8117
1Magento
1Magento
Jun 17, 2026
Nov 5, 2019
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticates user can inject arbitrary JavaScript code via product view id specificatio...Show more
A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticates user can inject arbitrary JavaScript code via product view id specification.Show less
CVE-2019-8115
1Magento
1Magento
Jun 17, 2026
Nov 5, 2019
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
A reflected cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated admin user can inject arbitrary JavaScript code when adding an image fo...Show more
A reflected cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated admin user can inject arbitrary JavaScript code when adding an image for during simple product creation.Show less
CVE-2019-8092
1Magento
1Magento
Jun 17, 2026
Nov 5, 2019
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
A reflected cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can inject arbitrary JavaScript code via email template preview.
CVE-2019-6142
1Forcepoint
2Email Security
Security Manager
Jun 17, 2026
Nov 5, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
It has been reported that XSS is possible in Forcepoint Email Security, versions 8.5 and 8.5.3. It is strongly recommended that you apply the relevant hotfix in order to remediate this issue.
CVE-2011-1135
1S9y
1Serendipity
Nov 21, 2024
Nov 5, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-Site Scripting (XSS) in Xinha, as included in the Serendipity package before 1.5.5, allows remote attackers to execute arbitrary code in plugins/ExtendedFileManager/manager.php and plugins/ImageManager/manager.php.
CVE-2011-1133
1S9y
1Serendipity
Nov 21, 2024
Nov 5, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-Site Scripting (XSS) in Xinha, as included in the Serendipity package before 1.5.5, allows remote attackers to execute arbitrary code via plugins/ExtendedFileManager/backend.php.
CVE-2010-3674
2Debian
Typo3
2Debian Linux
Typo3
Nov 21, 2024
Nov 5, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
TYPO3 before 4.4.1 allows XSS in the frontend search box.
CVE-2010-3672
1Typo3
1Typo3
Nov 21, 2024
Nov 5, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
TYPO3 before 4.3.4 and 4.4.x before 4.4.1 allows XSS in the textarea view helper in an extbase extension.
CVE-2013-6364
2Debian
Horde
2Debian Linux
Groupware
Nov 21, 2024
Nov 5, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
Horde Groupware Webmail Edition has CSRF and XSS when saving search as a virtual address book
CVE-2013-4107
1Cryptocat Project
1Cryptocat
Nov 21, 2024
Nov 5, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cryptocat before 2.0.22: cryptocat.js handlePresence() has cross site scripting
CVE-2010-3669
1Typo3
1Typo3
Nov 21, 2024
Nov 4, 2019
N/A· v4
5.4 MEDIUM· v3
4.9 MEDIUM· v2
TYPO3 before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows XSS and Open Redirection in the frontend login box.
CVE-2010-3665
1Typo3
1Typo3
Nov 21, 2024
Nov 4, 2019
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows XSS on the Extension Manager.
CVE-2014-3649
1Redhat
1Jboss Aerogear
Nov 21, 2024
Nov 4, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
JBoss AeroGear has reflected XSS via the password field
CVE-2019-18667
1Pfsense
1Pfsense Pkg Freeradius3
Jun 17, 2026
Nov 2, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
/usr/local/www/freeradius_view_config.php in the freeradius3 package before 0.15.7_3 for pfSense on FreeBSD allows a user with an XSS payload as password or username to execute arbitrary javascript code on a victim brows...Show more
/usr/local/www/freeradius_view_config.php in the freeradius3 package before 0.15.7_3 for pfSense on FreeBSD allows a user with an XSS payload as password or username to execute arbitrary javascript code on a victim browser.Show less
CVE-2019-18664
1Secudos
1Domos
Jun 17, 2026
Nov 2, 2019
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
The Log module in SECUDOS DOMOS before 5.6 allows XSS.
CVE-2013-4168
3Debian
FedoraprojectSmokeping
3Debian Linux
FedoraSmokeping
Nov 21, 2024
Nov 1, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in SmokePing 2.6.9 in the start and end time fields.
CVE-2019-18654
1Avg
1Anti Virus
Jun 17, 2026
Nov 1, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
A Cross Site Scripting (XSS) issue exists in AVG AntiVirus (Internet Security Edition) 19.3.3084 build 19.3.4241.440 in the Network Notification Popup, allowing an attacker to execute JavaScript code via an SSID Name.
CVE-2019-18653
1Avas!t
1Antivirus
Jun 17, 2026
Nov 1, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
A Cross Site Scripting (XSS) issue exists in Avast AntiVirus (Free, Internet Security, and Premiere Edition) 19.3.2369 build 19.3.4241.440 in the Network Notification Popup, allowing an attacker to execute JavaScript cod...Show more
A Cross Site Scripting (XSS) issue exists in Avast AntiVirus (Free, Internet Security, and Premiere Edition) 19.3.2369 build 19.3.4241.440 in the Network Notification Popup, allowing an attacker to execute JavaScript code via an SSID Name.Show less
CVE-2013-0186
1Redhat
2Cloudforms
Manageiq Enterprise Virtualization Manager
Nov 21, 2024
Nov 1, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Multiple cross-site scripting (XSS) vulnerabilities in ManageIQ EVM allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2010-3660
1Typo3
1Typo3
Nov 21, 2024
Nov 1, 2019
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows XSS on the backend.